Skip to main content
It’s Tuesday. The email isn’t from Claire — it’s from Marcus on the platform team. Subject line: “What exactly can this thing run?” Claire told Marcus an agent in customer success is issuing its own SQL against production BigQuery. Before anything touches a shared environment, Marcus needs three clear answers:
  • Whose credentials are being used?
  • What can those credentials do?
  • What stops it from running a DELETE query?
He finishes with: “I’m not blocking you. I just need answers first.” This is the POC from last Wednesday coming back to bite us. Marcus is right — those three questions are reasonable platform-team concerns. Yesterday you might have struggled to answer them; today you’ll be able to answer them properly. Along the way we’ll settle the long-running question: should you use handwritten function tools or MCP?
A presentation slide titled "Three Fair Questions" listing: "Whose credentials are being used?", "What can those credentials do?", and "What stops it from running a delete query?". Below the text is a simple diagram showing a Churn Agent connecting to a shared environment containing a Production BigQuery icon.
Right now two versions of the agent sit on your machine:
  • Left: the function-tool version — a handwritten function called getCustomer that embeds a parameterized SQL query.
  • Right: the MCP version — an MCP toolbox where the model writes its own SQL and calls an “execute SQL” tool.
Both use the same model, the same instruction, and we asked the same question (customer CUS0003115). Both returned five. Example SQL forms used:
Both answers are correct — but which approach should you build and deploy? Compare them across five dimensions to decide.
A dark-themed comparison table titled "Five Dimensions" contrasting "Function Tool" and "MCP" across rows like "Who writes the SQL?", "Flexibility", "Safety", "Setup", and "Reuse." Each cell contains short notes (e.g., "You do" vs "The model, fresh every question" and "Tight — one parameterized query" vs "Broad — runs whatever the model writes").
Summary table (quick at-a-glance): Deep dive on each dimension
  1. Who writes the SQL?
  • Function tools: you author the SQL. You choose columns, joins, and filters, and you can validate the query before the model ever sees it.
  • MCP: the model composes SQL on every request, so the exact SQL varies with prompts and context.
  1. Flexibility
  • Function tools: fixed surface area. To answer new questions (e.g., “which 5 accounts dropped fastest?”) you must implement additional queries.
  • MCP: flexible. The model can synthesize novel queries in response to ad-hoc questions without code changes.
  1. Safety (Marcus’s primary concern)
  • Function tools: tight and auditable. Parameterized queries treat user input as data, preventing the model (or an attacker) from changing query structure.
  • MCP: broad and harder to contain. An execute_sql tool could run any SQL the model outputs, so you must introduce guardrails and policy enforcement.
Best practice: use parameterized queries and least-privilege credentials to minimize risk. Parameterization prevents SQL injection and makes it trivial to audit which statements the system can run.
  1. Setup and operational complexity
  • Function tools: low friction. Implement a function in Python (or your language of choice), install a dependency or two, and deploy.
  • MCP: requires an MCP server/toolbox, a defined protocol, and additional deployment/monitoring work.
  1. Reuse and scale
  • Function tools: reuse is at the code level (copy, import, or publish a package).
  • MCP: built for cross-client reuse — one toolbox can serve multiple agents and use cases.
Make the choice that matches your constraints
  • If your top priority is safety, auditability, and minimal blast radius: prefer function tools with parameterized queries and least-privilege credentials.
  • If you need broad, exploratory capability and are willing to invest in guardrails, auditing, and runtime controls: MCP gives you the flexibility to ask new questions without code changes.
Neither option universally wins. Function tools trade flexibility for containment and auditability. MCP trades containment for flexibility and reuse. Your choice should reflect your risk tolerance, operational capacity, and how dynamic your query surface needs to be. Links and references

Watch Video